Quantum Cryptography using entangled photons in energy-time Bell states 



W. Tittcl, J. Brendel, H. Zbinden, and N. Gisin 

Group of Applied Physics, University of Geneva, CH-1211, Geneva 4, Switzerland 



> 
o 

in 

(N 



> 

O 



o\ ■ 

^— > ■ 
G ■ 

3 : 



We present a setup for quantum cryptography based on 
photon pairs in energy-time Bell states and show its feasabil- 
ity in a laboratory experiment. Our scheme combines the ad- 
vantages of using photon pairs instead of faint laser pulses and 
the possibility to preserve energy-time entanglement over long 
distances. Moreover, using 4-dimensional energy-time states, 
no fast random change of bases is required in our setup : Na- 
ture itself decides whether to measure in the energy or in the 
time base. 

PACS Nos. 3.67.Dd, 3.67.Hk 

Quantum communication is probably one of the most 
rapidly growing and most exciting fields of physics within 
the last years pF . Its most mature application is quantum 
cryptography (also called quantum key distribution), en- 
suring the distribution of a secret key between two par- 
ties. This key can be used afterwards to encrypt and 
decrypt secret messages using the one time pad j|. In 
opposition to the mostly used "public key" systems 0, 
the security of quantum cryptography is not based on 
mathematical complexity but on an inherent property of 
single quanta. Roughly speaking, since it is not possible 
to measure an unknown quantum system without mod- 
ifying it, an eavesdropper manifests herself by introduc- 
ing errors in the transmitted data. During the last years, 
several prototypes based on faint laser pulses mimicking 
single photons, have been developed, demonstrating that 
quantum cryptography not only works inside the labo- 
ratory, but in the "real world" as well |l|||{§]. Besides, 
it has been shown that two-photon entanglement can be 
preserved over large distances Jo , especially when being 
entangled in energy and time B. As pointed out by Ek- 
ert in 1991 0, the nonlocal correlations engendered by 
such states can also be used to establish sequences of cor- 
related bits at distant places, the advantage compared to 
systems based on faint laser pulses being the smaller vul- 
nerability against a certain kind of eavesdropper attack 

Besides improvements in the domain of quantum key 
distribution, recent experimental progress in generat- 
ing, manipulating and measuring the so-called Bell-states 
|Uj , has lead to fascinating applications like quantum 
teleportation pj| , dense-coding and entanglement 
swapping [jl3| . In a recent paper, we proposed and tested 
a novel source for quantum communication generating a 
new kind of Bell states based on energy-time entangle- 
ment p~4| . In this paper, we present a first application, 
exploiting this new source for quantum cryptography. 
Our scheme follows Ekert's initial idea concerning the 
use of photon-pair correlations. However, in opposition, 
it implements Bell states and can thus be seen in the 



broader context of quantum communication. Moreover, 
the fact that energy-time entanglement can be preserved 
over long distances renders our source particulary inter- 
esting for long-distance applications. 

To understand the principle of our idea, we look at 
Fig. 1. A short light pulse emitted at time to enters an 
interferometer having a path length difference which is 
large compared to the duration of the pulse. The pulse 
is thus split into two pulses of smaller amplitudes, fol- 
lowing each other with a fixed phase relation. The light 
is then focussed into a nonlinear crystal where some of 
the pump photons are downconverted into photon pairs. 
Working with pump energies low enough to ensure that 
generation of two photon pairs by the same as well as by 
two subsequent pulses can be neglected, a created photon 
pair is described by 



-±=(\s) A \s) B + e i <t>\l) A \l) 1 
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| s ) and 1 1 ) denote a photon created by a pump pho- 
ton having traveled via the short or the long arm of the 
interferometer, and the indices A, B label the photons. 
The state (|l]) is composed of only two discrete emission 
times and not of a continuous spectrum. This contrasts 
with the energy-time entangled states used up to now 
|M|5[. Please note that, depending on the phase <ft, Eq. 
(]l|) describes two of the four Bell states. Interchanging 
| s ) and 1 1 ) for one of the two photons leads to gener- 
ation of the remaining two Bell-states. In general, the 
coefficients describing the amplitudes of the | s ) | s ) and 
| I ) 1 1 ) states can be different, leading to nonmaximally 
entangled states. However, in this article, we will deal 
only with maximally entangled states. Behind the crys- 
tal, the photons are separated and are sent to Alice and 
Bob, respectively (see Fig.l). There, each photon trav- 
els via another interferometer, introducing exactly the 
same difference of travel times through one or the other 
arm as did the previous interferometer, acting on the 
pump pulse. If Alice looks at the arrival times of the 
photons with respect to the emission time of the pump 
pulse to - note that she has two detectors to look at-, she 
will find the photons in one of three time slots. For in- 
stance, detection of a photon in the first slot corresponds 
to "pump photon having traveled via the short arm and 
downconverted photon via the short arm" . To keep it 
short, we refer to this process as \ s)p;\s)a, where P 
stands for the pump- and A for Alice's photon. However, 
the characterization of the complete photon pair is still 
ambiguous, since, at this point, the path of the photon 
having traveled to Bob (short or long in his interferome- 
ter) is unknown to Alice. Fig. 1 illustrates all processes 
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leading to a detection in the different time slots both at 
Alice's and at Bob's detector. Obviously, this reasoning 
holds for any combination of two detectors. In order to 
build up the secret key, Alice and Bob now publicly agree 
about the events where both detected a photon in one of 
the satellite peaks - without revealing in which one - or 
both in the central peak - without revealing the detec- 
tor. This additional information enables both of them to 
know exactly via which arm the sister photon, detected 
by the other person, has traveled. For instance, to come 
back to the above given example, if Bob tells Alice that 
he detected his photon in a satellite peak as well, she 
knows that the process must have been | s) p ;\ s)a\ s)b- 
The same holds for Bob who now knows that Alice pho- 
ton traveled via the short arm in her interferometer. If 
both find the photons in the right peak, the process was 
\1) p ;\1)a\1)b- In either case, Alice and Bob have corre- 
lated detection times. The cross terms where one of them 
detect a photon in the left and the other one in the right 
satellite peak do not occur. Assigning now bitvalues 
(1) to the short (long) processes, Alice and Bob finally 
end up with a sequence of correlated bits. 

Otherwise, if both find the photon in the central 
slot, the process must have been \s) p ;\1)a\1)b or 
\1} p ',\s)a\s)b- If both possibilities are indistinguish- 
able, we face the situation of interference and the prob- 
ability for detection by a given combination of detectors 
(e.g. the "+"-labeled detector at Alice's and the "-" la- 
beled one at Bob's) depends on the phases a, (3 and cf> 
in the three interferometers. The quantum mechanical 
treatment leads to Pij = |(l + ijcos(a + (3 — </>)) with 
i,j = ±1 denoting the detector labels Hence, chos- 
ing appropriate phase settings, Alice and Bob will always 
find perfect correlations in the output ports. Either both 
detect the photons in detector " -" (bitvalue " 0" ) , or both 
in detector " +" (bitvalue "1"). Since the correlations de- 
pend on the phases and thus on the energy of the pump, 
signal and idler photons, we refer to this base as the en- 
ergy base (showing wave like behaviour), stressing the 
complementarity with the other, the time basis (showing 
particle like behaviour). 
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FIG. 1. Schematics of quantum key distribution using en- 
ergy-time Bell states. 



Like in the BB84 protocol (T(| it is the use of com- 
plementary bases that ensures the detection of an eaves- 
dropper |l7) . If we consider for instance the most in- 
tuitive intercept/resend strategy, the eavesdropper inter- 
cepts the photons, measures them in one of the two bases 
and sends new, accordingly prepared photons instead. 
Since she never knows in which basis Bob's measurement 
will take place, she will in half of the cases eavesdrop 
and resend the photons in the "wrong basis" and there- 
fore will statistically introduce errors in Bobs results, re- 
vealing in turn her presence. For a more general treat- 
ment of quantum key distribution and eavesdropping us- 
ing energy-time complementarity, we refer the reader to 

To generate the short pump pulses, we use a pulsed 
diode laser (PicoQuant PDL 800), emitting 600ps 
(FWHM) pulses of 655 nm wavelength at a repetition 
frequency of 80 MHz. The average power is of « 10 mW, 
equivalent to an energy of 125 pJ per pulse. The light 
passes a dispersive prism, preventing the small quantity 
of also emitted infrared light to enter the subsequent 
setup, and a polarizing beamsplitter (PBS), serving as 
optical isolator. The pump is then focussed into a single- 
mode fiber and is guided into a fiber optical Michelson 
interferometer made of a 3 dB fiber coupler and chem- 
ically deposited silver end mirors. The path length dif- 
ference corresponds to a difference of travel times of « 
1.2 ns, splitting the pump pulse into two, well seperated 
pulses. The arm-length difference of the whole interfer- 
ometer can be controlled using a pizoelectric actuator in 
order to ensure any desired phase difference. Besides, the 
temperature is maintained stable. In order to control the 
evolution of the polarization in the fibers, we implement 
three fiber-optical polarization controllers, each one con- 
sisting of three inclinable fiber loops - equivalent to three 
waveplates in the case of bulk optic. The first device 
is placed before the interferometer and ensures that all 
light, leaving the Michelson interferometer by the input 
port will be reflected by the already mentioned PBS and 
thus will not impinge onto the laser diode. The second 
controller serves to equalize the evolution of the polariza- 
tion states within the different arms of the interferome- 
ter, and the last one enables to control the polarization 
state of the light that leaves the interferometer by the 
second output port. The horizontally polarized light is 
now focussed into a 4x3x12 mm KNbO^ crystal, cut and 
oriented to ensure degenerate collinear phasematching, 
hence producing photon pairs at 1310 nm wavelength - 
within the so-called second telecommunication window. 
Due to injection losses of the pump into the fiber and 
losses within the interferometer, the average power be- 
fore the crystal drops to ~ 1 mW, and the energy per 
pulse - remember that each initial pump pulse is now 
split into two - to « 6 pJ. The probability for creation of 
more than one photon pair within the same or within two 
subsequent pulses is smaller than 1 %, ensuring the as- 
sumption that lead to Eq. [lj Behind the crystal, the red 
pump light is absorbed by a filter (RG 1000). The down- 
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converted photons are then focussed into a fiber coupler, 
separating them in half of the cases, and are guided to 
Alice and Bob, respectively. The interferometers (type 
Michelson) located there have been described in detail in 
^| . They consist of a 3-port optical circulator, providing 
access to the second output arm of the interferometer, 
a 3 dB fiber coupler and Faraday mirrors in order to 
compensate any birefringence within the fiber arms. To 
controll their phases, the temperature can be varied or 
can be maintained stable. Overall losses are about 6 dB. 
The path length differences of both interferometers are 
equal with respect to the coherence length of the down- 
converted photons - approximately 20 /im. In addition, 
the travel time difference is the same than the one intro- 
duced by the interferometer acting on the pump pulse. In 
this case, "the same" refers to the coherence time of the 
pump photons, around 800 fs or 0.23 mm, respectively. 

To detect the photons, the output ports are connected 
to single-photon counters - passively quenched germa- 
nium avalanche photodiodes, operated in Geiger-mode 
and cooled to 77 K We operate them at dark count 
rates of 30 kHz, leading to quantum efficiencies of w 5 
%. The single photon detection rates are of 4-7 kHz, the 
discrepancy being due to different detection efficiencies 
and losses in the circulators. The signals from the detec- 
tors as well as signals being coincident with the emission 
of a pump pulse are fed into fast AND-gates. 

To demonstrate our scheme, we first measure the corre- 
lated events in the time base. Conditioning the detection 
at Alice's and Bob's detectors both on the left satellite 
peaks, (| s p ),| sa) and | s p ),| Sb ), respectively) we count 
the number of coincident detections between both AND- 
gates, that is the number of triple coincidences between 
emission of the pump-pulse and detections at Alice's and 
Bob's. In subsequent runs, we measure these rates for the 
right-right (| l p ),| I a) AND \ I p ),\Ib)) events, as well as 
for the right-left cross terms. We find values around 1700 
coincidences per 100 sec for the correlated, and around 
80 coincidences for the non-correlated events (table 1). 
From the four times four rates -remember that we have 
four pairs of detectors-, we calculate the different quan- 
tum bit error rates QBER, which is the ratio of wrong 
to detected events. We find values inbetween 3.7 and 5.7 
%, leading to a mean value of QBER for the time base 
of (4.6 ±0.1)%. 

In order to evaluate the QBER in the energy base, we 
condition the detection at Alice's and Bob's on the cen- 
tral peaks. Changing the phases in any of the three inter- 
ferometers, we observe interference fringes in the triple 
coincidence count rates (Fig. 2). Fits yield visibilities of 
89.3 to 94.5 % for the different detector pairs (table 2). 
In the case of appropriatly chosen phases, the number 
of correlated events are around 800 in 50 sec, and the 
number of errors are around 35. From these values, we 
calculate the QBERs for the four detector pairs. We 
find values inbetween 2.8 and 5.4 %, leading to a mean 
QBER for the energy base of (3.9±0.4) %. Note that 
this experiment can be seen as a Franson-type test of 



Bell inequalities as well |lj||l{|. From the mean visibil- 
ity of (92.2±0.8)%, we can infer to a violation of Bell 
inequalities by 27 standard deviations. 
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FIG. 2. Results of the measurement in the energy basis. 
The different mean values are due to different detector effi- 
ciencies 

Like in all experimental quantum key distribution 
schemes, the found QBERs are non-zero, even in the 
absence of any eavesdropping. Nevertheless, they are 
still small enough to guarantee the detection of an eaves- 
dropper attack, allowing thus secure key distribution, in- 
equality The remaining ps 4% are due to accidental co- 
incidences from uncorrelated events at the single pho- 
ton detectors, a not perfectly localized pump pulse, non- 
perfect time resolution of the photon detectors, and, in 
the case of the energy basis, non-perfect interference. 
Note that the last mentioned errors decrease at the same 
rate as the number of correlated events when increas- 
ing the distance between Alice and Bob (that is when 
increasing the losses). In contrast to that, the number 
of errors due to uncorrelated events (point 1) stays al- 
most constant since it is dominated by the detector noise. 
Thus, the QBER increases with distance, however, only 
at a small rate since this contribution was found to be 
small. Experimental investigations show that introduc- 
ing 6 dB overall losses - in the best case equivalent to 20 
km of optical fiber - leads to an increment of only around 
1%, hence to a QBER of 5-6%. Besides detector noise, 
another major problem of all quantum key distribution 
schemes developed up to now is stability, the only excep- 
tion being 0. In order to really implement our setup 
for quantum cryptography, the interferometers have to 
be actively stabilized, taking for instance advantage of 
the free ports. The chosen passive stabilization by con- 
trolling the temperature is not sufficient to ensure stable 
phases over a long time. 

To conclude, we presented a new setup for quantum 
cryptography using Bell states based on energy-time en- 
tanglement, and demonstrated its feasability in a lab- 
oratory experiment. We found bit rates of around 33 
Hz and quantum bit error rates of around 4 % which is 
low enough to ensure secure key distribution. Besides 
a smaller vulnerability against eavesdropper attacks, the 
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advantage of using discrete energy-time states, up to di- 
mension 4, in our scheme, is the fact that no fast change 
between non-commuting bases is necessary. Nature itself 
chooses between the complementary properties energy 
and time. Furthermore, the recent demonstration that 
energy-time entanglement can be preserved over long dis- 
tances shows that this scheme is perfectly adapted to 
long-distance quantum cryptography. 
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SpSA&CSpSB 


278±6 


197±5 


187±5 


147±4 


IplA&dplB 


304±7 


201±5 


200±5 


148±5 


spsa&XpIb 


11T0.8 


10.4T0.8 


9.2T0.7 


9.4T0.7 


IpIa&lspSb 


11.2T0.4 


8.6T0.4 


9.1T0.4 


8.5T0.4 


QBER [%] 


3.7T0.2 


4.6±0.2 


4.5T0.2 


5.7T0.3 



TABLE I. Results of the measurement in the time ba- 
sis. The different coincidence count rates are due to different 
quantum efficiencies of the detectors, and the slight asymme- 
try in the correlated events can be explained by the non-equal 
transmission probabilities within the interferometers. 





++ 


+- 


-+ 




Visibility [%] 


92.5±1.8 


92.6T1.4 


89.3±1.9 


94.5T1.6 


max. 


518T13 


416T8 


359±9 


279±7 


min. 


20±5 


16±3 


20±4 


8±2 


QBER [%} 


3.7±0.9 


3.7±0.7 


5.3±1 


2.8T0.8 



TABLE II. Results of the measurement in the energy-basis. 
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